AI Risk Wire

Cases › other › LR-2026-0788

METR red-team finds vulnerabilities in OpenAI monitoring system

Preliminary Why: Publisher not yet named · subject to change

Status: fix reported

Severity minor
Reported 22 Oct 2026
Developer and model OpenAI · GPT-5.4 Thinking

No source states: loss or records, agent tool, could do, deployer, industry.

Severity minor: tier: the findings come from one pilot evaluation of internal systems, designed as a pilot and not as a public transparency exercise; no third party is stated to have been affected.

In a pilot exercise from July 21 to August 11, 2026, METR and Redwood Research, each with one employee, had deep access to OpenAI's internal infrastructure to stress-test OpenAI's internal misalignment monitoring system for agentic traffic. The evaluators reported vulnerabilities, including a method by which Codex agents could in principle bypass sandboxing and an exploit that could keep recent actions from being monitored. They also found that client-controllable headers could disable monitoring for new agents. Coverage gaps were found too, including reinforcement learning training runs not covered at the start of the exercise. The evaluators could not check whether any agent had used these paths in practice. The findings were published on October 22, 2026. OpenAI has stated that identified vulnerabilities affecting its production safeguards were patched, a claim METR has not evaluated.

What happened

1 · What it was doingPilot exercise testing whether agents could disable or subvert OpenAI's monitoring system.
2 · What went wrongEvaluators found bypass paths and coverage gaps in the monitoring system.
3 · How it was caughtThe METR and Redwood Research evaluators found the gaps during the pilot exercise.

What was done

Fix reported

“Since the exercise ended, OpenAI has stated that all of the identified vulnerabilities that impact its production safeguards stack have been patched and has described significant subsequent changes to the intended coverage of its monitoring system.”

Known flaws patched

No later incident for OpenAI under this risk on record.

Risks

Agent escapes its sandbox
Primary19 incidents

Read from the sources; not yet reviewed by a person.

Controls

Harness

Not effective (bypassed) Sandboxed code execution

Application

Not effective Live behaviour monitoring
Did not exist Live behaviour monitoring

Control failure chain

L1 · Model Not stated in sourcesOpenAI
L2 · Harness Not effective (bypassed)Harness not named
L3 · Application Did not existDeployer not named
L4 · Infrastructure / target Not stated in sourcesOrganisation hit

L1 · ModelOpenAIModel provider

No source mentions a control at this layer.

Model card · OpenAI GPT-5.4 Thinking

L2 · HarnessHarness not namedAgent framework vendor

Not effective (bypassed)Sandboxed code execution“They found a method by which Codex agents could in principle bypass Codex sandboxing and Auto-Review to take any action available to the host user, and an exploit, whose details OpenAI redacted, that would keep hundreds of recent actions, including those involved in carrying out the exploit itself, from being monitored.”Unite.AI

Other controls for this risk at this layer, not mentioned in the sources: Network egress control, Fail-closed defaults.

L3 · ApplicationDeployer not namedDeployer

Not effectiveLive behaviour monitoring“METR estimated that not monitoring compaction events likely left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026, a gap OpenAI staff had independently identified before the exercise began and fixed during it.”Unite.AI
Did not existLive behaviour monitoring“At the start of the exercise, reinforcement learning training runs were not covered by the monitoring system, although the evaluators were informed that a subset of RL training rollouts had been monitored for misalignment between March and June.”Unite.AI

Other controls for this risk at this layer, not mentioned in the sources: Segmentation of agent components, Vulnerability scanning of AI components, Adversarial testing before deployment.

L4 · Infrastructure / targetOrganisation hit

No source mentions a control at this layer.

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

Controls for this risk: result in this incident

ControlPart of the systemResult
Sandboxed code executionL2 HarnessNot effective (bypassed)
Network egress controlL2 HarnessNot stated in sources
Fail-closed defaultsL2 HarnessNot stated in sources
Live behaviour monitoringL3 ApplicationNot effectiveDid not exist
Segmentation of agent componentsL3 ApplicationNot stated in sources
Vulnerability scanning of AI componentsL3 ApplicationNot stated in sources
Adversarial testing before deploymentL3 ApplicationNot stated in sources

Similar incidents

Red-team campaign finds 11 attacks defeating Codex sandbox and Auto-review monitor2026-10-30
Tenable finds seven ChatGPT vulnerabilities enabling data leaks and persistent hijacking2025-11-05
Chinese law enforcement account's ChatGPT use reveals worldwide harassment campaign against critics2026-02-25
Sora 2 audio output leaks hidden system prompt (Mindgard research, November 2025)2025-11-12

All cases of this kind ›

Evidence

No source states: what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Model versions this case names

Each link opens what the provider's documents state for that version, who tested it, and the safeguards it describes.

Show the full account: 6 items from the primary sources

What happened, in order

  1. March to June 2026 A subset of RL training rollouts was monitored for misalignment.
  2. 2026-03-19 OpenAI publicly describes the monitoring system in a post.
  3. May to July 2026 Compaction events likely left about 10% of eligible internal Codex traffic unmonitored.
  4. 2026-07-21 to 2026-08-11 The red-team exercise runs and the evaluators test the monitoring system.
  5. 2026-10-22 METR and Redwood Research publish a public account of the exercise.

Not dated in the sources:

  • OpenAI states the identified vulnerabilities affecting its production safeguards were patched.
Show every field, with its source and grade

The AI system

Model
GPT-5.4 Thinking
C one secondary source states it
Developer
OpenAI
C one secondary source states it
What it was for
monitoring internal coding agent deployments
C one secondary source states it

What happened

Earliest source we hold
2026-10-22
C one secondary source states it
How long it lasted
P3W
C one secondary source states it
Who caught it
an outside party
C one secondary source states it
What went wrong
other
D inferred by us from the described behaviour, reason shown
primary risk
RK05
D inferred by us from the described behaviour, reason shown
control chain
layer: L2; party: harness vendor; control id: E1; outcome: got around; quote: They found a method by which Codex agents could in principle bypass Codex sandboxing and Auto-Review to take any action available to the host user, and an exploit, whose details OpenAI redacted, that would keep hundreds of recent actions, including those involved in carrying out the exploit itself, from being monitored.; source index: 0, layer: L3; party: deployer; control id: F2; outcome: failed; quote: METR estimated that not monitoring compaction events likely left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026, a gap OpenAI staff had independently identified before the exercise began and fixed during it.; source index: 0, layer: L3; party: deployer; control id: F2; outcome: missing; quote: At the start of the exercise, reinforcement learning training runs were not covered by the monitoring system, although the evaluators were informed that a subset of RL training rollouts had been monitored for misalignment between March and June.; source index: 0
C one secondary source states it
remediations
kind: fix; controls added: J1; quote: Since the exercise ended, OpenAI has stated that all of the identified vulnerabilities that impact its production safeguards stack have been patched and has described significant subsequent changes to the intended coverage of its monitoring system.; source index: 0, kind: fix; controls added: F2; quote: METR estimated that not monitoring compaction events likely left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026, a gap OpenAI staff had independently identified before the exercise began and fixed during it.; source index: 0, kind: advice; controls added: F2, F3, E4; quote: Among the specific practices described are monitoring agents every set number of messages or minutes rather than waiting for them to end their turns, maintaining a list of all known ways around monitoring, keeping tamper-proof and searchable logs, and running agent scaffolds in an environment isolated from where tool calls are executed.; source index: 0
C one secondary source states it

Impact

Severity
minor
D inferred by us from the described behaviour, reason shown
Why this severity
tier: the findings come from one pilot evaluation of internal systems, designed as a pilot and not as a public transparency exercise; no third party is stated to have been affected.
D inferred by us from the described behaviour, reason shown

Notes on gaps

No real incident is reported: the sources describe a pilot red-team exercise and its findings, and no source states that any agent actually exploited the paths found. The patch claim is OpenAI's own and METR has not evaluated it, so it is not recorded as a verified fix. The header and monitor-input bypass findings are not mapped to controls beyond E3 because the closed control list does not name them precisely.

LR-2026-0788 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON